Good to hear about 3.7PL2.

Are the emails coming from the "Contact Us" page? If so, then two ways really

1. Edit the phrase and remove the "Contact Us if you think this is wrong" incase they didnt think of doing that

2. Disable the "Contact Us" page in vBulletin options.

Are the registrations all spammers? Maybe you could PM me a copy/paste of your logs so that I can verify theyre spammers and not the plugin gone mad.

Edit : This mod doesnt send emails

.. oh, the next version will do spambot filtering on the Contact Us page as well :)

This looks awesome - and *exactly* what I need at the moment! :) My forum gets around 55,000 unique visitors and 250,000 pageviews a day - and it's being ruined by spammers! I'll post back in a few days to let you know the results (it's already caught one and I only installed it 60 seconds ago!).

Thanks pedigree! :)

Ok, I just had a legitimate new member try to register and he got the spammer rejection message (our very first)....

It didn't like his IP address, indicating it has been used by someone to spam forums in the past. Here?s the information from the log:

What's very odd is that the actual IP address he was using when he tried to log on our site was IP Address: 195.93.21.8, which differs from the one he was rejected for?

Is something broken here? :confused:

By the way, I changed the username and email address for pivacy purposes.

Regards,
Badger

Checking that IP on the stopforumspam.com website, it's linked to an AOL.com email address. AOL also owns that IP range. Most likely someone was spamming from a computer w/ AOL as the ISP. AOL frequently cycles IP addresses around, so that's how they got that IP.

AOL operate transparent proxy servers that filter/monitor and record all HTML data passing from their networks, for many reasons, data mining, advertising etc... It being on the same 24 subnet is a bit strange bit who knows what AOL think.

ISPs that transparently redirect/filter and cache HTTP traffic are always going to be a problem when filtering on IP numbers. I thought about filtering on the HTTP_FORWARDED_FOR headers fromthe caches but that would easily allow a spammer to inject headers and therefore bypass filtering.

All I can suggest is create him an account and mail him the password or decrease the age expiry to under 30 days, that will treat the record at sfs.com as too old and will ignore it.... Or even better, tell him to get his ISP to turn off proxying. A friend owns an ISP and with bandwidth being so cheap compared to the overhead of running caching servers, given the low hits, he turned them all off.

This raises the question of one of the missing features of the site regarding modding up an IP, email or username. Right now you can flag something bad, but can never rectify that (unless you flagged it and manually remove it from your list of spammers)..

Obviously a concept like this is prime for fraud if not done correctly.

Anyone have any suggestions on how we may implement a "whitelist" feature without inviting automated bots to pollute the database?

I think those questions are best raised on the stopfrorumspam.com website. I did kind of foresee that and thats why I put a "lastseen" expiry in the mod. By default, from memory, its 90 days. 0.7 has whitelisting features for username/email and IP addresses/subnets as well as the said expiry.

Expiry being that a postive spambot result from stopforumspam.com with a lastseen thats older than the threshold set in your options, will result in a negative spambot result. This kind of works around some of the issues.

That's how I handled this individual...

Thanks ... :)

Regards,
Badger

No solution is ever going to be perfect :(